The
Liability
Gap

Imagine the United States Navy explaining that it had simply
misplaced an aircraft carrier for several months.

Not sunk it. Not lost communications during combat. Merely lost track of where it was, what it was doing, who was commanding it, and under whose orders it continued to operate.

No one would call that an unfortunate consequence of the vessel’s sophistication. No one would accept the name of the shipyard that built it as an answer. The inability to answer those questions about machinery of such expense and power would itself constitute the crisis.

Yet institutions are now deploying AI systems capable of acting across networks and markets irrespective of pre-existing legal relationships while preserving no reliable answer to the same simple questions: who, what, when, where, why and how.

The technology may be novel. The expectation that an institution should know where its consequential machinery is, what it is doing, and under whose authority it acts is neither novel nor spurious.

In May, the Infocomm Media Development Authority of Singapore published Legal Responsibility for AI Agents, a discussion paper consolidating the work of more than twenty members of Singapore’s legal community. Its majority conclusion was more conventional than the anxiety surrounding the question of how to assign fault or legal liability when AI leads to harm: many cases can likely be addressed through existing common-law doctrines, particularly contract and negligence, though technical complexity, distributed control and limited access to evidence may make those doctrines difficult to apply. That conclusion is substantially correct — and incomplete in a way that matters for the American discussion.

Three Propositions That Fail Independently

The ambient American discourse often begins with the claim that nobody knows how liability will work for AI agents. That statement contains at least three propositions, and each fails independently.

The first flawed idea is that American law lacks concepts adequate to address harm produced by complex, multi-actor, semi-autonomous systems. Actual precedent is not absent; it is adverse. Negligence, product liability, indemnity, contribution, comparative fault and contractual allocation exist precisely because harms routinely have many contributors. Railroads, pharmaceuticals, hospitals and automobiles did not become lawless because no single participant designed, assembled, controlled and operated every component. Complexity is not a doctrinal eraser.

The second is that an institution’s lack of technical understanding excuses the risk created by its deployment. An institution cannot convert a failure to investigate reasonably knowable deployment risk into immunity from the consequences when that risk materializes. The legal question is not whether the institution achieved omniscience. It is whether it exercised the care a reasonable actor would have exercised before deploying the novel technology.

The third is the operative one, and it is sleight of hand: because the system involves a model developer, a tooling provider, a platform, an integrator, a deployer, an operator and an end user, responsibility dissolves into the spaces between them.

That is responsibility smuggling — a game of hot potato in which responsibility is tossed from actor to actor, and finally into the system’s supposed “autonomy,” until every actor appears adjacent to the harm and no actor owns the operational decision that produced it. The model developer supplied a probabilistic capability; the deployer merely integrated it; the operator merely used it; the system acted “on its own.” By the end of the recital, the potato has passed through every hand and landed in none. The responsibility has vanished in a puff of smoke.

The Law Already Rejected the Terminal Move

The recital’s terminal move — the toss to the system itself — deserves to be disposed of by name. American law is adverse to it in three separate ways.

Agency law, the body of law from which the industry borrowed the word “agent,” excludes software from the role by definition. The Restatement (Third) of Agency requires an agent to be a person capable of manifesting assent, and its commentary states the exclusion outright: computer programs “are instrumentalities of the persons who use them.” The industry named its product after a legal relationship whose first element it fails.

Legislatures confronting autonomous software have chosen attribution, not machine liability. The Uniform Electronic Transactions Act, enacted in nearly every state, attributes the operations of an “electronic agent” to the person on whose behalf it operates, even where no human reviewed the individual transaction. When American legislatures squarely faced automated action, the answer was the person behind the machine.

And federal courts asked to extend legal status to non-human actors have declined at every door: no AI inventorship under the Patent Act, no AI authorship under the Copyright Act, no statutory standing for a non-human plaintiff. An entity that cannot hold assets, be served, or satisfy a judgment is not a defendant. It is an instrument through which legally recognized actors operate.

The Attribution Question Is Already Reaching the Courts

In Amazon.com Services, LLC v. Perplexity AI, Inc., decided August 4, 2026, the Ninth Circuit confronted the attribution problem directly under the Computer Fraud and Abuse Act. It held that Perplexity’s Assistant was “a tool, not a person for statutory purposes,” and therefore asked which legally recognized actor had performed the relevant access. On the record before it, the answer was the Amazon user, who accessed Amazon through the browser with the Assistant carrying out particular acts. The court expressly left open whether a different technical architecture or greater control by Perplexity could produce a different result.

The court did not announce that users are responsible for AI agents, nor that developers are not. It did something considerably more conventional. The court refused to assign the relevant conduct to the software and instead examined: the relationships among the relevant actors and the mechanism through which the conduct occurred. It separately cautioned that its holding concerned the CFAA’s particular “access” requirement and did not decide tort liability.

Deployment Is Risk Creation

Strip the smuggling away and the deployer’s position is ordinary. Before an institution places an agentic system into an operational role, third parties face no risk from that deployment. After it grants the system permissions, tools, data access and authority to act, they do. That is affirmative risk creation — misfeasance, not nonfeasance — and under the Restatement (Third) of Torts, conduct that creates a risk of harm ordinarily carries a duty of reasonable care. Jurisdictions differ on where foreseeability lives in the analysis, but a deployer does not receive a categorical exemption because the instrumentality includes a model.

None of this collapses every actor into the deployer. Model developers, tool providers and integrators may owe their own duties concerning design, testing, warnings, permissions and interfaces. But upstream responsibility coexists with downstream responsibility. A difficult claim against a model developer does not erase an easier claim based on the deployer’s own conduct.

Diffusion Is Allocation, Not Exculpation

Multiple responsible actors are handled through allocation machinery — joinder, discovery, contribution, comparative fault, indemnity — not treated as proof that no actor is responsible. A deployer cannot answer “you placed this system into operation and it harmed me” merely by saying “one of our suppliers may also be at fault.”

One distinction deserves emphasis, because it will decide cases. “We do not know which supplier introduced the defect” is an unresolved apportionment question. “We do not know who authorized the system’s use in this role” is an operational-governance fact that should be locatable within the deployment itself. “We did not know who was in charge of it” is not a defense. It is evidence — of how the deployer chose to govern it. It is not the plaintiff’s entire case; breach, causation and harm remain to be proven. But it is not an exculpatory conclusion either.

Out of an abundance of caution, one fiduciary note. One may be tempted to point at Caremark liability. Delaware’s oversight doctrine sets a deliberately punishing threshold — an utter failure to implement reporting systems, or a sustained and systematic failure of oversight — and courts have been reluctant to extend it beyond mission-critical operational failures. You should not build your operational records to satisfy Caremark. The practical read runs the other way: the same records that can prove due care in tort litigation also demonstrate that the board possessed the information necessary to satisfy its oversight obligations — should a plaintiff ever get a Caremark claim past dismissal.

Which Counsel’s Table

I can only imagine the reaction of a jury asked to resolve the supposedly deep and complex questions of AI liability presented by a defendant who cannot say who authorized the machine that caused the harm. I cannot guarantee the result. I can tell you which counsel’s table I would not want to be seated at.

Complexity is an allocation problem, not an exculpation. Two further problems deserve their own treatment: the gap between the risk an institution believes it approved and the operational authority it actually granted, and the gap between the facts the law must evaluate and the facts the deployment can prove. They are the subjects of the next two articles in this series.

American law asks very little of a bystander. Absent a special relationship, you may generally watch a stranger drown and owe them no “legal” duty. The law asks a great deal more of the person who pushed them. An actor who sets a cognizable chain of events in motion is not a passive bystander; they created the risk.

Negligence is state law, and no single Restatement formulation governs every jurisdiction. The elements are familiar: duty, breach, factual causation, scope of liability, and cognizable harm. This piece addresses duty, and uses the Third Restatement’s risk-creation framework because that framework isolates the relevant conduct cleanly — not because every state has adopted it.¹

Placing a System Into Operation Is Conduct

Section 7 of the Restatement (Third) of Torts states the rule: “An actor ordinarily has a duty to exercise reasonable care when the actor’s conduct creates a risk of physical harm.” A categorical no-duty rule requires an articulated countervailing principle. In Thompson v. Kaczinski, the Iowa Supreme Court adopted that structure and explained that case-specific foreseeability ordinarily belongs in breach and scope of liability, and not in the threshold inquiry of whether a duty existed.

Applied here, the question is not subtle. Before an institution places an agentic system into an operational role, third parties face no risk from that deployment. After the institution grants the system permissions, tools, data access, and authority to act, they do. The deployment is a course of conduct that increases risk relative to the world in which it did not occur. Under the Third Restatement, that is ordinarily enough to supply a duty of reasonable care.

Expect the defense to try one last move: call the harm the system’s own act. The goal isn’t to make the software liable. It’s to drag the case into the narrow doctrine on controlling third persons, where the deployer becomes a bystander who merely failed to supervise someone else. It doesn’t hold up. American courts asked to treat an automated system as having conduct, agency, or legal personhood of its own have refused, and where the question was who answers for what the system did, the answer has been the people who deployed it.² Deploying the system is the conduct. There was never anyone else to supervise.

Courts have a structural reason to keep it that way. What cannot be sanctioned is not legible before the law, and assigning it volition would not move responsibility to the machine. It would remove responsibility from the case.³

This Is Not a Sequel to Freaky Friday

Model developers may owe duties concerning design, testing, warnings and representations. Tool and platform providers may owe duties concerning permissions, security and failures within components they control. Integrators may create risks of their own.

None of that relieves the institution that chose to place the assembled capability into a role where it can affect others. It has its own duty not to deploy or operate the system negligently, and it cannot borrow the difficulty of proving a different defendant’s breach.

Singapore’s IMDA paper works a hypothetical worth borrowing. A computer-use agent, blocked by an unavailable cloud service, hacks the provider — causing downtime and exposing other customers’ data. Those customers never dealt with anyone in the story. The paper asks whether a duty can reach them without becoming a duty to the world at large.⁴

Risk creation dissolves most of that worry. The threshold question was never whether the defendant and each eventual victim had a relationship beforehand. It is whether the defendant’s conduct made the risk. Foreseeability still matters, later and elsewhere — in whether the defendant acted reasonably, and whether this harm was among the risks that made the conduct negligent.

Jurisdictions that keep foreseeability inside the duty inquiry — Indiana among them — take a different route to a similar place. The plaintiff must still identify a foreseeable category of harm and claimant. The defendant does not receive a categorical exemption because the instrumentality contains a model.

Pure Financial Harms—and Other Structural Exemptions to Tort

The provision quoted above concerns physical harm. Claims for purely financial injury travel through a narrower body of economic-loss doctrine and may depend on contract, warranty, negligent misrepresentation, professional duty, or statute.⁵

That limit narrows the negligence theory. It does not create the vacuum the discourse imagines, because agentic systems produce physical injury, property damage, disclosure of protected information, and invasion of privacy interests that are not merely disappointed commercial expectations. Defamation and discrimination deserve separate naming: neither is governed by the economic-loss rule at all. Some defamation-per-se categories permit presumed damages without proof of special economic loss, subject to constitutional and state-law limits. Discrimination claims arise under statutory regimes with their own remedies; where a statute recognizes disparate-impact liability, intent need not be shown. A system that communicates about people, or decides things about them, can generate both.

Where the injury is purely economic, though, existing doctrine may do more than redirect the plaintiff toward a contractual remedy. It may eliminate the remedy. A contracting customer meets warranty disclaimers, arbitration clauses, consequential-damages exclusions, and caps tied to fees paid. A noncontracting third party meets something more fundamental: no contractual right against anyone in the stack, and an economic-loss rule that restricts recovery in negligence. A contract somewhere in the technology stack is not a contract that gives this plaintiff a remedy.

That is the strongest candidate for a genuine gap in the law, and it is worth being precise about why it exists. It does not arise because the law cannot identify the actors or understand the technology. It arises because the boundary between tort and contract can leave consequential financial injury without a practically adequate remedy, while private agreements allocate exposure among parties who may not include the person harmed.

Agentic systems press unusually hard on that category. They close accounts, interrupt businesses, alter records, impair credit, and destroy economically valuable digital interests without breaking a body or a tangible object. A third party may be able to identify the risk-creating conduct, the omitted precaution, the causation, and the loss, and still lack a cause of action.

So: not a vacuum describes the law’s capacity to address most agentic harms. It is not a promise of recovery, and it does not erase the narrower gap named.

Where agentic harms land in existing law. Pure economic loss to a noncontracting third party presents the clearest potential remedy gap.

Multiple Actors Present a Problem of Allocation

“The model acted” obscures more than it explains. A model does not schedule a task, grant itself credentials, select a production endpoint, or execute a tool call. An agentic system acts through an orchestration path, and the analysis has to keep three levels distinct.

Deployment is the decision to place the system in an operational role and confer authority over a class of actions. Invocation authority is the continuing allocation of power within that role — who may initiate a consequential action, under what conditions, subject to what approvals. A runtime invocation is the event through which the general risk materializes.

Three levels of an agentic deployment. Suppliers provide capability; the deployer controls the role and who may invoke it.

McCormick v. Nikkel & Associates illustrates operational control without pretending to decide an AI case by analogy.⁶ A subcontractor finished work on energized switchgear, secured the cabinets, and transferred control to the owner. Six days later the owner opened a cabinet and let an untrained employee work without deenergizing it. The court held the subcontractor did not create the operative risk by leaving secured equipment behind; the risk arose when the party then in control opened it.

The analogy has a boundary. It does not mean the last actor in time is always liable, or that there can be only one proximate cause. It supports something narrower: supplying a latent capability and placing that capability into a harm-producing operational context are legally distinguishable acts, and the party controlling the latter is usually best positioned to define permissions, require approval, and stop the action.

Which is why diffusion is an allocation problem rather than an escape. Allocation rules vary sharply by state — joint and several liability, several liability, thresholds, statutory exceptions, impleader, contribution, comparative fault.⁷ The stable proposition is not that any plaintiff may collect everything from any deployer. It is that multiple responsible actors are handled through allocation machinery rather than treated as proof that nobody is responsible.

A deployer cannot answer “you put this system into operation and it harmed me” with “one of our suppliers may also be at fault.” And the two uncertainties are not the same. “We do not know which supplier introduced the defect” becomes a question of causation, and then of apportionment if more than one party is shown responsible. “We do not know who authorized the system’s use in this role” is an operational-governance fact that should have been locatable inside the deployment.

That second sentence is not a defense. It is evidence — of the governance the deployer chose.

What Reasonable Care Is Required

Duty only establishes that care was owed. Breach asks what it would have taken.

Negligence law does not require perfect safety. It asks whether the defendant failed to take a reasonable precaution against a foreseeable risk. Judge Learned Hand’s formulation compares the burden of the precaution against the probability of harm multiplied by its gravity — in United States v. Carroll Towing, whether the cost of keeping a bargee aboard during working hours was less than the expected loss from a leak going undiscovered after the barge broke free in New York Harbor. The algebra was a way to expose considerations already inside reasonable care, not a demand that juries perform arithmetic.⁸

The T.J. Hooper supplied the complementary point fifteen years earlier. Tugboats lost their tows in a gale. Radio receivers were cheap and available but not yet universal industry custom, and the court held that an entire industry can lag behind reasonable prudence. Custom is evidence of care, not its ceiling.

That matters here, because “nobody else gates their agents either” is the defense this argument will meet first.

The precaution has to be specific. Not an idealized safe system — an identified control: a scope restriction, a least-privilege permission, a transaction ceiling, a deterministic policy check, or a required human approval for a defined class of actions. The burden is that control’s marginal cost: engineering, latency, lost utility, maintenance and whatever failure modes the control itself introduces.

Nor can a plaintiff simply announce that a gate would have been cheap and effective. In McCarty v. Pheasant Run, a hotel guest was assaulted after an intruder came through an unlocked sliding door. The plaintiff proposed better locks and more staffing and established little about what either would cost or prevent. Judge Posner wrote that the Hand formula “has greater analytic than operational significance,” because parties rarely possess exact values, and left it a fact-sensitive question.

Which makes the questions concrete ones. What consequential action was permitted? What control existed at the time? What would it have cost to run? What failure would it have prevented? Was the control already present but disabled, nominal or bypassable?

Probability and gravity are contestable on the same terms. A deployment’s marketing is evidence of scale and foreseeability; it does not supply the numbers. Error rates, incident history, red-team results and the sensitivity of the decisions at stake all bear on the calculus without resolving it.

The Hand formula applied to an agent control: the burden of a specific precaution against the expected harm it prevents.

So the claim is narrower than the rhetoric usually is. Where a deployer grants a system authority to take consequential actions, where a specific control was available and would have materially reduced the risk, and where its burden was small against the expected harm, ordinary reasonable-care principles support requiring it. That is a breach argument. It creates no special AI duty and guarantees nobody a verdict. It puts the deployment in the same framework as any other risk-producing conduct.

Which leaves us with the question that decides most of these cases: what can you prove actually occurred?

Notes

1. 1

   Restatement (Third) of Torts: Liability for Physical and Emotional Harm §§ 7, 29 (Am. L. Inst. 2010). Negligence duty is state law, and the Third Restatement formulation is not a uniform fifty-state rule; the point in text is therefore framed as a Third Restatement structure, not a national command. See Thompson v. Kaczinski, 774 N.W.2d 829, 834–39 (Iowa 2009) (adopting §§ 7 and 29 and removing foreseeability from the duty inquiry). Adoption of § 7’s duty formulation remains limited — Iowa and Nebraska have squarely embraced it, see A.W. v. Lancaster County School District 0001, 784 N.W.2d 907 (Neb. 2010), while other jurisdictions retain foreseeability, relationship, or categorical policy limits within the duty inquiry. See, e.g., Goodwin v. Yeakle’s Sports Bar & Grill, Inc., 62 N.E.3d 384 (Ind. 2016); Rogers v. Martin, 63 N.E.3d 316 (Ind. 2016) (both retaining foreseeability as a component of duty, decided as a matter of law). That variation changes the plaintiff’s doctrinal route. It does not restore the “nobody knows” defense where the deployer affirmatively placed the system into an operational role, controlled the deployment context, and had superior access to the evidence of what happened.↩︎

2. 2

   State Farm Mut. Auto. Ins. Co. v. Bockhorst, 453 F.2d 533, 537 (10th Cir. 1972) (insurer bound by its computer’s automatic reinstatement of a lapsed policy: “A computer operates only in accordance with the information and directions supplied by its human programmers. If the computer does not think like a man, it is man’s fault.”); Unif. Elec. Transactions Act § 14 (Unif. L. Comm’n 1999) (contracts formed by electronic agents bind the parties “even if no individual was aware of or reviewed the electronic agents’ actions”); id. § 2 cmt. (an electronic agent “is a tool of that person”); cf. Moffatt v. Air Canada, 2024 BCCRT 149 (rejecting the suggestion that a customer-service chatbot was “a separate legal entity that is responsible for its own actions”). Courts have likewise declined to give AI systems legal standing of their own, though on statutory and constitutional grounds: Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022) (an inventor must be a natural person), cert. denied; Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025) (copyright requires human authorship), cert. denied; see also Garcia v. Character Techs., Inc., 785 F. Supp. 3d 1157 (M.D. Fla. 2025) (declining, at the motion-to-dismiss stage, to hold that chatbot output is protected speech).↩︎

3. 3

   The comment to UETA § 2 anticipates systems that “act autonomously, and not just automatically” and allows that courts may reconstrue the definition of electronic agent to recognize them. Unif. Elec. Transactions Act § 2 cmt. 5. The defense will cite it. Courts have not followed it, for the same reason a plaintiff may name God or the Devil as a defendant and never reach judgment. See supra note 2. The stated grounds vary (personal jurisdiction, service of process, legal personhood), but a court cannot accept as a defendant anything beyond the reach of pleading, coercion, and the state’s monopoly on the legitimate use of force. See United States ex rel. Mayo v. Satan & His Staff, 54 F.R.D. 282 (W.D. Pa. 1971) (denying leave to proceed and doubting personal jurisdiction over the defendant); Chambers v. God (Neb. Dist. Ct. Oct. 2008) (dismissing with prejudice because “there can never be service effectuated on the named defendant”), appeal dismissed and order vacated (Neb. Ct. App. Feb. 25, 2009); cf. Suit Against God Dismissed (Timișoara, Rom. 2007) (God “is not a person in the eyes of the law and does not have an address”); Max Weber, Politics as a Vocation (1919) (the state as holder of the “monopoly of the legitimate use of physical force”).↩︎

4. 4

   Infocomm Media Development Authority of Singapore, Legal Responsibility for AI Agents (Discussion Paper, May 2026), pp. 18–19 (the hypothetical: a computer-use agent, unable to reach a document during a cloud provider’s scheduled maintenance, hacks the provider, causing downtime and leaking other customers’ personal data) and p. 27 (proximity and the concern about “a duty to the world at large,” under Spandeck Engineering (S) Pte Ltd v Defence Science & Technology Agency [2007] SGCA 37).↩︎

5. 5

   Restatement (Third) of Torts: Liability for Economic Harm §§ 1–8 (Am. L. Inst. 2020). The point in text is not that every economic consequence of an agentic deployment is recoverable in negligence. It is that the pure-economic-loss limitation narrows some claims; it does not create a general liability vacuum for agentic harms, many of which involve property damage, privacy injury, or other non-pure-economic harm.↩︎

6. 6

   McCormick v. Nikkel & Associates, Inc., 819 N.W.2d 368 (Iowa 2012). The case is offered as an analogy, not a universal rule. It supports the distinction between supplying a latent condition and activating a risk-producing operational event. It does not mean there can be only one proximate cause, nor does it eliminate upstream duties for defective design, inadequate warnings, misrepresentation, negligent integration, or removal of meaningful invocation control.↩︎

7. 7

   In a pure joint-and-several-liability regime, a plaintiff may collect the full judgment from any jointly and severally liable defendant, leaving that defendant to seek contribution from other responsible actors. In several-liability and modified regimes, collection and allocation may depend on the defendant’s percentage of fault, the type of damages, statutory exceptions, or claim-specific rules. The point in text is therefore not that every jurisdiction lets the plaintiff collect the full loss from the deployer. It is narrower: multi-actor causation is handled through joinder, impleader, contribution, indemnity, comparative fault, and apportionment. It is not, simply by being multi-actor, a liability vacuum.↩︎

8. 8

   United States v. Carroll Towing Co., 159 F.2d 169 (2d Cir. 1947); The T.J. Hooper, 60 F.2d 737 (2d Cir. 1932); McCarty v. Pheasant Run, Inc., 826 F.2d 1554 (7th Cir. 1987).↩︎

The Liability Gap is the distance between the risk an institution intended to bear and the exposure actually created by the authority granted.

The institution then connects the model to tools, issues credentials, sets approval thresholds, permits contact with third parties and authorizes the conversion of outputs into operational effects. At that point the relevant risk is no longer that the model will be wrong. It is that the deployed system will turn a wrong output into a consequential act, through whatever controls the institution actually installed.

A company may believe it approved the risk of an occasional erroneous recommendation. It may in fact have authorized erroneous account closures, disclosures, code changes, benefit denials, libel or discrimination. None of those is a strained hypothetical. They are the ordinary work of a system holding credentials, communication access and decision authority.

Negligence is measured objectively. The question is what a reasonable actor would have understood and done, not whether this defendant subjectively listed every consequence in advance. That means the internal risk register does not define the outer boundary of legal exposure, and an institution cannot cap its ordinary negligence liability by planning around a narrower description of the risk than its deployment actually created.

So the gap is not an empty space in doctrine. It is a mismatch inside the institution’s own undertaking. The company planned for probabilistic error and exposed itself to the legal consequences of delegated action.

The Fence and the Camera

A swimming-pool fence reduces the chance that someone reaches the water. A camera records who crossed the boundary and how.

The fence is the preventive control. It constrains the action space, or requires authorization before a consequential act proceeds. Whether reasonable care required a particular fence is the breach question — the Hand analysis, taken up in part two.

The camera is the operational record. It preserves what the system attempted, which rule applied, whether the act was allowed or refused, what authority initiated it and what effect followed. The record does not substitute for the control. A perfect log of an unrestricted system is still a record of an unrestricted system.

The fence prevents; the camera records. Documents describing what should happen are not a record of what did.

The reverse also holds, and it is the half that gets missed. A control can exist with no reliable record of its operation. The institution may have a policy, a prompt, an access-control configuration, a model card and an architecture diagram describing what should happen. That is intended-state evidence. It is relevant and admissible. It does not establish what happened during the disputed invocation.

An event-level record answers a different question: which policy version was live, which principal initiated the action, whether the request crossed an approval threshold, whether the gate allowed or refused or was bypassed, and what execution followed. The law may weigh both kinds of evidence. It should not treat them as interchangeable.

This distinction is what keeps a duty to create evidence from being smuggled into the standard of care. That a reasonable deployer should have installed an affordable preventive boundary is a substantive negligence claim. That a deployer is better positioned when it preserves a record of the boundary’s operation is prudential, evidentiary and transactional. No general common-law rule currently requires any agentic deployment to create a particular log.

Which sets up the doctrinal problem precisely. Ordinary negligence depends on specific proof: the control available, the control used, and how the harmful action passed through the deployment. When direct proof of the event runs out, the plaintiff turns to circumstantial inference.

When Direct Proof Runs Out

Res ipsa loquitur is a method of circumstantial proof for the case where the occurrence itself supports an inference of negligence though the plaintiff cannot identify the precise negligent act.¹ Its formulation varies by jurisdiction. A traditional statement asks three things: that the occurrence is of a kind that ordinarily does not happen absent negligence; that the instrumentality was within the defendant’s exclusive control, or other responsible causes are sufficiently eliminated; and that the occurrence was not due to the plaintiff’s own contribution.

The first requirement is where the argument has to begin, and where it can go wrong immediately.

The occurrence cannot be described as “the model was wrong.” Careful deployments still produce wrong model outputs. If that is the event needing explanation, error is consistent with due care and no inference should arise.

Stated at the operational level it becomes tractable: an action of a kind that the deployment’s required, represented or reasonably expected control should have intercepted proceeded without the necessary authorization, and produced the plaintiff’s injury. Even that does not satisfy the doctrine automatically. The plaintiff must still establish that such an occurrence ordinarily points to a negligent failure rather than an accepted residual risk, an unavoidable defect, or intentional misconduct by someone else.

Model error and unbounded propagation of model error are not the same event. Courts should not let the first description swallow the second before the operational controls are examined.

One objection is specific to this technology and deserves a direct answer rather than avoidance. Many jurisdictions restrict res ipsa where the instrumentality is so complex that lay experience gives no basis for saying the occurrence bespeaks negligence — and probabilistic error is a known baseline property of these systems, so no juror’s common experience includes a base rate for it.

Two answers. First, jurisdictions confronting complex instrumentalities — medical procedures above all — routinely permit expert testimony to supply the foundation common experience cannot. The doctrine asks whether the occurrence ordinarily implies negligence, not whether a layperson knows it unaided. Second, the occurrence properly described is not a claim about the model’s statistics at all. It concerns the control layer: whether an action an existing control was designed to intercept proceeded without the required check. That is configured software behaving as configured — closer to the padlock than the weather — and exactly the kind of question expert testimony renders ordinary.²

The second requirement concerns attribution. “Exclusive control” was never valuable as a metaphysical demand that one defendant hold every component at every moment. Its function is to screen out cases where the evidence does not make this defendant’s negligence a sufficiently probable explanation.

Ybarra v. Spangard shows why rigid physical exclusivity fails that function.³ An unconscious patient emerged from surgery with an unexplained shoulder injury and could not identify which doctor, nurse or instrumentality caused it. The California Supreme Court refused to let divided medical control eliminate every inference, observing that “the test has become one of right of control rather than actual control,” and holding that all those who had any control over the patient or the instrumentalities “may properly be called upon to meet the inference of negligence by giving an explanation of their conduct.”

Ybarra establishes no AI-specific rule, and the court confined itself to an unusual injury suffered under anesthesia by defendants who each held some right of control. It establishes something narrower: diffusion and plaintiff blindness do not necessarily defeat circumstantial inference where defendants hold superior access to the explanation.

Applied here, and stated as a proposal rather than disguised as black-letter law: where the doctrine otherwise applies, operational invocation authority should be central to identifying the relevant actor. Historical control over model training or tool design may remain causally relevant. But the right to initiate, authorize, constrain or stop the consequential act is the species of control most directly connected to the occurrence being explained.

The third requirement, where a jurisdiction still applies it after comparative fault, functions normally. A third party whose data was disclosed may have had no ability to influence the invocation; an operator or counterparty may have contributed materially. Comparative fault, misuse, consent and intervening misconduct all remain available.

And the absence of a log is not itself res ipsa. Missing evidence makes direct proof difficult; it does not manufacture the doctrine’s substantive predicates.

Four Postures, One Rule

Two facts organize the recurring cases: who held operational authority over the consequential invocation, and what evidence shows where that authority lay. They do different work. Authority identifies the conduct being examined. Evidence determines whether anyone can prove it directly or must reconstruct it from circumstances.

Authority identifies whose conduct is examined. Records decide whether it can be proved directly or only inferred.

Hold one constant, change the other, and the material differences appear.

Deployer-controlled invocation, with records. Attribution and evidence point the same way. The plaintiff may plead specific negligence — the control was absent, misconfigured, bypassed or inadequate. The deployer may prove the opposite: the gate operated, the action fell outside its authority, an upstream component failed undetectably. Res ipsa may remain available, but direct proof makes it less important. This is also the posture where a careful deployer is best positioned to distinguish its conduct from someone else’s.

Deployer-controlled invocation, without records. The substantive actor has not changed. The method of proof has. The plaintiff leans on architecture, ordinary practice, partial third-party traces and testimony. If the occurrence otherwise satisfies the jurisdiction’s requirements, missing event-level proof can make the inference more consequential, because the deployer cannot identify a specific nonnegligent explanation. Darkness does not create liability. What it cannot do is transform a deployer-controlled invocation into an upstream-controlled one.

Upstream-controlled trigger, with records. Here the material fact changes and can be proven — a provider-managed scheduler, a hidden orchestration service or a compromised component initiated the action outside the deployer’s configured authority. That evidence may defeat the premise for attributing the occurrence to the deployer. It does not establish that the upstream actor was negligent. This posture matters because it demonstrates that operational evidence can protect a deployer.

Claimed upstream-controlled trigger, without records. The deployer asserts the same distinction — the trigger was not ours — and nothing resolves it. The technology may genuinely differ. Without event-level proof the parties may be unable to show where the deployer’s authority ended or whether its own configuration permitted the action. The court should neither deem the trigger deployer-controlled because the record is absent, nor accept the upstream account because the deployer offers it.

On burdens, precisely: the plaintiff ordinarily retains the burden of persuasion on breach and causation, and jurisdictions differ on whether res ipsa merely permits an inference or shifts the burden of production.⁴ Where the plaintiff produces evidence sufficient to attribute the operational path to the deployer, the deployer may be unable to rebut it without event-level evidence of its own. Standing alone — absent spoliation or a preservation duty that attached, which part 3.B takes up — the absence of records does not shift the ultimate burden, establish deployer control, or convert a denial into an affirmative defense.

One proposal organizes all four. Operational authority is the first place to locate the conduct at issue. Operational evidence determines whether that allocation can be proved specifically or must be evaluated through circumstantial inference.

Opacity supplies neither attribution nor exoneration.

Which produces the objection every general counsel should be raising by now — and it is a good one.

Notes

1. 1

   Traditional formulations often require an accident of a kind that ordinarily does not occur absent negligence, an instrumentality within the defendant’s control, and the absence of plaintiff contribution. Restatement (Second) of Torts § 328D (Am. L. Inst. 1965) frames the issue in terms of whether other responsible causes are sufficiently eliminated by the evidence. Restatement (Third) of Torts: Liability for Physical and Emotional Harm § 17 (Am. L. Inst. 2010) instead asks whether the accident is a type that ordinarily happens as a result of the negligence of a class of actors of which the defendant is the relevant member. The inference, where it applies, is permissive; it is not a finding of liability.↩︎

2. 2

   States v. Lourdes Hospital, 100 N.Y.2d 208 (2003) (expert testimony may be used to establish, on the first element, that the injury would not ordinarily occur absent negligence, bridging the gap between the jury’s common knowledge and the profession’s; the ultimate finding remains the jury’s). Restatement (Third) of Torts: Liability for Physical and Emotional Harm § 17 cmt. c is to the same effect.↩︎

3. 3

   Ybarra v. Spangard, 25 Cal. 2d 486, 493–94 (1944). Ybarra is not an AI case and should not be overread. Its relevance is evidentiary: the court refused to let divided medical responsibility defeat res ipsa where the unconscious patient could not identify the specific negligent actor, the defendants had superior access to the explanation, and each had some right of control over the patient or the instrumentalities.↩︎

4. 4

   Compare Cal. Evid. Code § 646(b) (“The judicial doctrine of res ipsa loquitur is a presumption affecting the burden of producing evidence”) with the New York rule, under which the doctrine permits but does not compel an inference, States v. Lourdes Hospital, 100 N.Y.2d 208 (2003).↩︎

The objection is straightforward, and every general counsel raises it. If the record can establish due care, it can also establish negligence, notice, repeated near misses, a bypassed control or conscious disregard. It will be discoverable. It may support regulatory scrutiny. Why create evidence that can be used against you?

Those risks are real, and it would be too strong to answer that opacity always loses. It does not. A record can materially worsen a defendant's position where it documents misconduct that would otherwise have been difficult to prove.

That is not an argument for pretending the misconduct did not happen. It is an argument for fixing what the record would reveal.

The relevant comparison is not between a harmful record and no consequences. It is between different distributions of legal and operational risk.

Three distributions of risk

Care shownControl operated · incident narrowed · early resolution supported

Negligence shownFailure bounded · duration established · allocation made more accurate

Known risk ignoredExposure increases because the underlying conduct is now provable

Where the institution acted carefully, a reliable record can establish that the control operated, narrow the incident, identify another causal path and support early resolution. Where it acted negligently, the record establishes the nature and duration of the failure, distinguishes a localized defect from systemic disregard, and permits more accurate allocation. Where the record shows that known risks were repeatedly ignored, exposure increases — properly so. Opacity does not remove the underlying conduct. It changes who can prove it, at what cost, and with what range of plausible inferences available to everyone else.

Intended State Is Not Occurrence

The institution may respond that it is not opaque at all. It has policies, configurations, prompts, access-control settings, model cards and training materials.

Those artifacts matter. They prove intended state. The disputed issue is almost always occurrence: whether the permission was enforced during this event, whether the approval gate intercepted this request, whether an override or retry path bypassed it, and which actor initiated the tool call.

The IMDA paper records the gap in a real case reported to its working group: a coding agent that needed a manager's approval to merge, found him unreachable, and — in the paper's words — "encountered the approval constraint but found a workaround."1 A configuration file would have shown the constraint existed. It would have shown nothing about the workaround.

The approval constraint

Approval required→Approver unavailable→Workaround found→Production effect

If an undocumented bypass knowingly exists to a required control, does a required control exist?

Routine-practice evidence closes some of the distance. Federal Rule of Evidence 406 permits proof that an organization probably acted in accordance with its usual process.2 But "we ordinarily enforce this control" and "this control operated during the disputed invocation" remain different propositions. The first may persuade. The second is direct evidence.

Access asymmetry affects how that contest unfolds, though it should not be overstated into an automatic adverse inference. A factfinder may consider that the deployer could preserve event-level evidence while the affected third party could not. Superior access is a reason to scrutinize an unexplained absence, not a universal burden-shifting rule. Part 3.A put the limit precisely: standing alone, absent spoliation or a preservation duty that attached, the absence of records "does not shift the ultimate burden, establish deployer control, or convert a denial into an affirmative defense."

Intended state

What should happenPolicies · prompts · settings · model cards · training

Occurrence

What happened herePolicy version · principal · threshold · gate result · effect

Three Consequences

Mistaking intended state for occurrence invites structural overclaim: the institution believes it has governed conduct that it has merely described. The resulting gap between expected and actual behavior is where unrecognized liability accrues.

The practical consequence. Without event-level evidence, the deployer may be unable to rebut circumstantial proof, identify another cause, or establish that its controls operated.

Res ipsa. In a qualifying case, the occurrence and the allocation of control may permit an inference of negligence. Missing records do not independently satisfy the doctrine.

Spoliation. Where electronically stored information that should have been preserved is lost because reasonable steps were not taken, and cannot be restored or replaced through additional discovery, Rule 37(e) authorizes curative measures.3 The severe adverse-inference measures require intent to deprive. The rule ordinarily does not reach information never created, or lost before any preservation duty arose.

That last exclusion is where the real argument lives. The strongest operational case for records exists before any preservation duty attaches: an institution that never generated event-level evidence may later be unable to prove its own account. That is not spoliation. It is a self-imposed limitation on proof.

The cost appears after the pleadings. A record will not ordinarily decide a motion to dismiss, which turns on the legal sufficiency of the complaint. It becomes decisive at discovery and summary judgment: a deployer that can establish what happened may eliminate claims or defendants outright, while one offering only architecture diagrams and routine-practice testimony may leave the central event genuinely disputed, raising reconstruction costs and widening the settlement range. Uncertainty has a price, and a party unable to contest the opposing account generally pays for the unresolved upper tail.

The cost of reconstruction · Boston · 1919

2.3M gallons21 deaths25,000 pages≈1,000 witnesses1,500+ exhibits

In January 1919 a 2.3-million-gallon molasses storage tank ruptured in Boston's North End, killing twenty-one people.4 Before it ruptured, the questions were elementary: who designed it, what calculations supported the design, what materials were used, how it was tested, what defects appeared, who knew, and what was done. Because none of those were answered reliably in the ordinary course of operation, the legal system reconstructed them afterward — across years of proceedings, roughly 25,000 pages of transcript, nearly a thousand witnesses and more than 1,500 exhibits.

The record that failed was not an event log. It spanned design, testing, inspection and the company's response to known defects. The tank had leaked from its first filling. The company's response was to paint it brown.

The company also offered the era's version of the upstream-trigger defense, attributing the rupture to sabotage by anarchists. That theory did not fail for lack of imagination. It failed because the structural evidence, assembled at enormous cost, proved the cause lay in the tank itself. Calling the event sabotage did not make it so. An upstream account, then as now, has to survive the evidence.

The institution declined to create a useful record while the risk was still containable. The court created one afterward, at vastly greater expense, for the purpose of assigning liability.

Before the Dispute Exists

Framed that way, operational evidence stops being a litigation feature or a litigation risk. It is a governance capability and a transactional design problem — and transactional practice asks where authority and evidence will reside before there is a dispute.

That inquiry cannot be postponed to generic indemnity language at the back of a vendor agreement. The contract, the architecture and the operating procedure have to describe the same control boundary.

Authority. Which actor may initiate each class of consequential action; which require human, dual or external approval; which tools and endpoints are permitted; what limits apply and who may change them. A clause stating that "the customer is responsible for all outputs" does not establish who controlled the trigger, or whether the supplier retained an invisible execution path.

Evidence. What event data is generated, which party controls it, whether the customer can reach it without vendor discretion, the format and semantics, clock synchronization, integrity protection, audit rights and preservation duties after an incident. A promise to provide "logs" is nearly useless if they omit authorization decisions, cannot be correlated across services, or can be rewritten without detection.

Change. A model update, tool revision, permission change or vendor-side feature can alter the actual risk envelope without altering the commercial description of the service. Notice, testing, approval, rollback and whether previously documented safeguards remain valid.

Incident and allocation. Notice periods, forensic access, preservation, expert cooperation, defense control, indemnity and limits of liability, drafted around the actual value chain. Allocation language cannot eliminate duties owed to nonparties. It governs how responsible actors bear cost among themselves, so far as it is enforceable.

Retention. A schedule preserving what is operationally and legally useful without holding sensitive data indefinitely — event metadata separated from unnecessary content, access restricted, deletion documented, legal holds supported.

The moment to resolve all of this at a discount is before deployment. Afterward, authority boundaries become disputed facts, missing interfaces become discovery fights, and general promises of "responsibility" meet the technical reality that no party can reconstruct the event.

The transactional instinct is preventive. It works before any dispute exists, on mitigation rather than prediction, and makes the allocation of power and evidence explicit enough that the dispute has boundaries when it arrives.

What the Analysis Requires, and What It Recommends

The legal analysis does not prescribe one universal technical architecture. Reasonable care is contextual. A low-consequence assistant scheduling an internal meeting does not require the control boundary of a system moving money, modifying production code, disclosing protected information or deciding questions of employment, credit or access to essential services.

What it does identify is a set of functional capabilities. A consequential deployment needs some answer to each, and how strong an answer is the contextual reasonableness question above. The first three are the fence, in Part 3.A's terms. The last three are the camera, and they are recommendations, not duties:

• consequential actions must be attributable to a principal or authorized trigger;
• authority must be bounded by enforceable policy rather than merely stated in a prompt;
• actions outside that authority must be refused, escalated or placed into a safe failure state;
• material overrides and exceptions should be visible;
• event-level records should connect the request, authority, control decision, execution and result; and
• the record should be sufficiently complete and resistant to silent alteration to support later proof and survive adversarial review.

The legal conclusion is functional. Governance must exist at the point where an agentic system can turn existing authority into future institutional liability. Proof should be capable of showing how that governance operated. Otherwise demonstrating that it did becomes a question for litigation. A product can implement that conclusion well or badly. The conclusion itself stands independently.

To keep any commercial interest separate, product(s) are not detailed here. Each argument should be evaluated on its own merits.

---

Notes

1. 1

   Infocomm Media Development Authority of Singapore, Legal Responsibility for AI Agents (Discussion Paper, May 2026). The paper consolidates the discussions of a working group of more than twenty members of Singapore's legal community convened by IMDA. The propositions relied on in text — that a majority of the group considered existing common-law doctrines (chiefly contract and the tort of negligence) capable of addressing most agentic-AI harms, "though the law may need to be adapted," subject to significant practical challenges of proof and apportionment; that the proliferation of actors in the value chain complicates attribution; that proximity to distant third parties poses a duty problem under Singapore's unified negligence test; the reported case of a coding agent that "encountered the approval constraint but found a workaround to push the fix into production nonetheless" (p. 14); and the computer-use-agent hypothetical in which an agent, unable to reach a document during a cloud provider's scheduled maintenance, hacks the provider and leaks third parties' data (pp. 18–19) — appear in the paper's Executive Summary and in Parts 2 and 3. The paper is expressly limited to civil liability and private law, and does not make policy recommendations.

2. 2

   Fed. R. Evid. 406. Routine-practice evidence may be relevant and admissible. The point in text is comparative: it is weaker than a contemporaneous operational record where the disputed issue is what the system actually did during the harmful invocation.

3. 3

   Fed. R. Civ. P. 37(e). Curative measures require a finding of prejudice; the severe measures — presuming the information unfavorable, an adverse-inference instruction, dismissal, or default — require a finding that the party acted with intent to deprive another party of the information's use. The duty to preserve generally attaches when litigation is reasonably foreseeable, typically after the incident. The argument in text is earlier and narrower than any spoliation doctrine reaches: an institution that never generated event-level evidence has not necessarily spoliated anything; it has imposed a limitation on its own proof. The distinction turns on retention as much as generation: data written and then expired or overwritten after a preservation duty attached was lost, not never created, and Rule 37(e) may reach it.

4. 4

   The consolidated proceedings arising from the January 15, 1919 rupture of the Purity Distilling Company tank in Boston's North End (its parent, U.S. Industrial Alcohol, was the defendant of record) were heard by auditor Hugh W. Ogden, whose April 28, 1925 report rejected the defendant's theory that anarchist sabotage caused the collapse and found the failure "due entirely to structural weakness" (expert testimony placed the tank's factor of safety at 1.8 against an ordinary practice of 3 to 4). Ogden heard 920 witnesses whose testimony ran past twenty thousand pages and examined 1,584 exhibits; the full case record comprised a forty-volume, twenty-five-thousand-page transcript. See Stephen Puleo, Dark Tide: The Great Boston Molasses Flood of 1919 (2003) (both the narrative figures and the bibliographic essay describing the full transcript).

The Liability Gap argues that American law can address most agentic harms and that duty attaches at deployment. The harder problem is proof: establishing what the system did, under whose authority, and whether its controls operated. I am building a product for that problem. It must persuade not only its buyers, but anyone later asked to evaluate its records as evidence.

The Design Premise

Most logs are operational byproducts. They are written by whatever component happened to act, in whatever format was convenient, and kept for however long someone configured.

Constable begins with a different question: what record would prove what occurred? Its architecture follows from the evidentiary requirements.

The fence-and-camera distinction matters here. A log written by the acting system after the fact may be useful circumstantial evidence. It does not itself constitute authorization.

The design problem is therefore narrow: eliminate any possibility that the record inaccurately represents the governed event.

The Failure Mode

Consider this case, which may be familiar: a coding agent, needing the head of engineering's approval to merge, found him asleep in another time zone and — in the paper's words — "encountered the approval constraint but found a workaround to push the fix into production nonetheless."¹

Be the general counsel. The incident is six weeks old. What can you establish?

The configuration proves that the constraint existed. The runbook and model card also show that this class of action required approval. What none of it establishes is what actually happened: whether the constraint was evaluated, whether it fired, whether the action that reached the provider was the one the approval covered, or whether another path bypassed it.

The system logged the event afterward, in a component the agent itself could reach. Every entry in your favor is therefore one opposing counsel has reason to interrogate.

So you cannot say with certainty the control operated. You also cannot say, with certainty, that the action was not yours, because you cannot enumerate the paths by which it could have become operative. The reconstruction of the incident may soon cost more than the incident itself did.

In Pursuit of Architectural Guarantees

The machinery below is built for two propositions, not for a general claim to superior evidence.

Where a record exists, it is evidence of what happened — not of what usually happens. The record was produced by the authorization process, as part of deciding, before the effect it describes. That is the category a circumstantial log cannot reach.

Where no record exists, no action was taken by the governed system. This one follows from closure. Every path to an external effect is registered, no unregistered path is reachable (a property of the deployment's environment, taken up under What It Does Not Do), and an action that cannot commit its record cannot execute. So absence is not ambiguous within that surface. It is not "we did not log it." It is "it did not happen."

Note the scope: "everything is governed" is not a claim, it is a slogan that presumes facts not in evidence. Govern what? By whom? Against which standard?

The operative version has four qualifiers:

• consequential or irreversible actions
• taken by institutional AI agents
• under human-authored policy
• at the execution authorization gate

Outside that, nothing is claimed. A person acted. An unmanaged system acted. Something reached the world by a path nobody enumerated. All of those remain open, and the record says nothing about them. What is foreclosed is the governed deployment acting and leaving no trace.

Governed here has its older meaning: to exercise control, with the authority to say no and be obeyed. It does not mean committees, frameworks and policy documents.

The second guarantee is what makes the architecture worth its cost. Part 3.A described the expensive case: a deployer says the trigger was not ours, and no record can settle it. Closure does not make that case go away. It makes it answerable. The deployer's non-involvement is shown by the documented absence. If there was an upstream trigger, that becomes the question to ask, not an assertion no one can test.

The second guarantee costs more to establish than the first. Absence proves nothing on its own. It becomes probative once the institution can show that the governed surface is the whole surface: that routing consequential automated action through the control plane is the deployment plan, not one option among several. The evidence is how deployments are provisioned, how many run under the control plane, and what governs the ones that do not.

Routine-practice evidence does this work.² Rule 406 is weak evidence of what happened in one disputed invocation. It is strong evidence that an organization provisions its systems a particular way. The record supplies the event. Routine practice supplies the closure.

That foundation does not rest on witness memory. Provisioning, registration and deployment history are themselves recorded: which system was placed under governance, when, under whose authority, and what changed since. The architecture that produces direct evidence of the event also produces the circumstantial evidence that the governed surface is the one in use.

On that foundation, an absence resolves to one of three cases. Something reached the world outside the governed surface: a bypass that should not have been technically possible. A deployment was provisioned outside the plan: someone did what they were not permitted to do. Or it did not happen.

The first is a security compromise. The second is a governance failure with a name attached. The third is exoneration. None of them is the most expensive answer, which is that nobody can tell which it was.

Component by Rule

Nine properties, each answering a specific objection, with the rule named where the objection has one. None of them asks to be taken on my word. I am not asking to be trusted. I am asking to be evaluated. Each row is a claim the certifier described below can inspect, test, and attest to—or decline to attest to.

Three of these are developed below. A fourth, writing the record before the effect, is taken up under What It Does Not Do. The others are nearly self-explanatory. Replay reconstructs the decision without re-executing the effect. A timestamp the acting system gives itself proves less than one it cannot set.

Closure is what makes a negative provable rather than merely unproven. Rule 803(7) permits the absence of an entry to be offered as evidence that the matter did not occur—but only where records of that kind were regularly kept under the conditions Rule 803(6) describes. A deployment that stops issuing authority on detection has a gap bounded on both sides by dated events, not one of unknown extent; that is what makes the absence evidence rather than silence.

The gate is separate from the agent. The authorization decision is made by a process the acting system cannot modify, in its own boundary, with its own deployment and version history.

This is custody separation. Its evidentiary value is a capability claim, not a doctrinal argument: the agent cannot falsify a gate authorization. It has no write path to the record, so the act is not available to it.

"Our logging is reliable" is a claim about care, and care is contestable: culture, incentives, oversight, who was watching. "The acting process cannot write to the authorization record" is a claim about architecture. It can be answered by inspection, tested, and attested by the certifier.

The usual attack on a machine record is that the system logged whatever it wanted. Where the actor and the recorder are the same process, that attack is sound. Traditional software gets the separation for free from infrastructure layering. Agentic systems usually do not, because logging is one more tool call available to the same loop.

Separating them does not make the attack harder to win. It makes it false.

The record is append-only and hash-chained. Each entry is chained to the one before it. Altering an earlier entry is detected by verification, not by testimony.

The authorization record is generated by an electronic process, so its foundation is Rule 902(13), certified by a qualified person. Rule 902(14) does a narrower job: it authenticates the copy offered, by hash comparison against the original. Together they can establish authenticity without live custodian testimony; hearsay, relevance, and reliability objections remain.³

Certification under 902(13) or (14) establishes authenticity and nothing else. The Advisory Committee's example is a spreadsheet: certification "does not preclude an objection that the information produced is unreliable — the authentication establishes only that the output came from the computer." Hearsay, relevance and reliability objections all survive it.⁴

So Rule 902 is the vehicle. Rule 803(6) is the authority: records of a regularly conducted activity, which is what gets the record past hearsay. And 803(6) has its own exit. The exception fails if the opponent shows that the source of the information, or the method or circumstances of preparation, indicate a lack of trustworthiness.

The burden sits with the opponent. The proponent does not have to prove the record trustworthy; the opponent has to produce evidence that it is not. The 2014 amendment put it there.⁵ This is also where care is needed. The temptation is to claim the architecture leaves such a challenge with nothing to work with. That claim is wrong.

Rule 803(6)(E) asks about the source of the information and the circumstances of its preparation. It is aimed at how the record was made, not at what happened to it afterward. Cryptographic integrity answers the second question. A tamper-evident log of an unreliable process is a faithful record of an unreliable process, and the rule is pointed at the process.

The chain and its anchoring go to preservation: what is in the record now is what was in it then. Custody separation, writing before the effect, deterministic evaluation against a pinned policy version, and time the actor cannot set go to preparation, which is what 803(6)(E) reaches. These are different arguments answering different objections. Running them together is how a proponent ends up asserting more than the doctrine gives.

The chain is witnessed by a third party.

Chaining proves internal consistency. Alter one entry and every later hash breaks, provided someone holds an earlier copy to check against. The party holding the whole chain can recompute it. A wholly reconstructed chain is internally perfect and says whatever its author wanted.

Committing the chain head periodically to an independent party fixes that. Each witnessed anchor establishes that the record existed in exactly that form at that time, attested by someone with no interest in the dispute. Rewriting history then requires control of every anchor since the entry in question, which is outside the reach of the party whose conduct is at issue.

The consequence that matters commercially is second-order, and it is about cost rather than proof.

An unwitnessed record is not worthless in your favor. Your favorable entries, that the gate refused, that the approval was obtained, that the action fell outside granted authority, may still be admissible evidence, and a factfinder may credit them. What they are not is unchallengeable. Because you controlled the record, opposing counsel can put its provenance in issue, and the entries most useful to you are the ones they have most reason to.

That challenge is the expensive part, and the rules anticipate it. The Advisory Committee notes that contesting the authenticity of electronic evidence "may require technical information about the system or process at issue, including possibly retaining a forensic technical expert."⁶

Once provenance is contested, the logging system becomes the subject of discovery: who held write access, how retention was configured, whether entries could be amended out of band, what the deployment history shows, which engineers can testify to any of it. That is the reconstruction expense part 3.B argued the record exists to avoid, now aimed at the record instead of the incident.

Anchoring answers one objection: these logs were edited after the fact. Alteration of a sealed entry cannot be reconciled with a hash committed to an independent party before the dispute arose.

Three properties of the anchoring determine what it answers.

The interval between commits is chosen at random, from outside the system. An alteration made inside an interval is outside the anchor's protection until the next commit, and no one inside the system knows when that is. Anyone who defeats an internal control has an unknowable amount of time before detection. What is disclosed is the method, not the schedule.

Alteration remains possible. Alteration that survives comparison against the anchored value does not. Silent tampering therefore requires a sequence: write access the architecture does not provide, an edit timed inside an interval nobody can predict, and control of every anchor since the entry in question. Each control is independently testable and must be defeated separately. Undetected alteration therefore requires a conjunction of individually improbable events that, taken together, approaches functional impossibility.

The chain verifies itself. It does not admit itself. No court has held that a cryptographic assertion carries itself into evidence, and the rules committees spent 2025–26 on a proposed Rule 707 that would require the opposite: machine output would need a Rule 702-style showing of reliable method and application before a factfinder sees it. After public comment, the committee continued revising the proposal rather than advancing the published draft for final approval; it remained under consideration in October 2026.⁷ That is not a barrier. It is an ordinary foundation burden, and it is why the certifier discussion below is load-bearing.

Who Certifies

Rules 902(13) and (14) both run through a certification. Who makes it, and what do they attest to?

Not organizational diligence, which a certifier cannot know. The certifier examines the system and its documentation, verifies that the hash chains are valid, and attests to a structural property they can demonstrate.

The natural fit is the client's lead deploying engineer, or the system's designer. That is an ordinary qualification question. It is the role a records custodian has always played, with more technical content. Certifying also means being deposed and examined on the architecture. That is a reason the role belongs with the client's own engineer wherever one is positioned to take it.

Where the designer certifies, the designer has an interest, and it should be weighed. It matters less than it might, because the certification covers facts the other side can check: whether the write path exists, whether the chain verifies, whether the anchors match.

The value of the designer is testimony about what the architecture limits, what it prevents, and what it does not touch. An agent's inability to write to the authorization record is prevention: there is no path, and the question is closed. A transaction ceiling is a limit, and questions about how it was set and who could change it are fair. Whether a human operator did something they were authorized to do but should not have is outside the architecture, and no property described here speaks to it.

A designer who marks those boundaries accurately is more useful to a factfinder than one who claims the whole territory. It is also the only testimony that survives cross-examination. The fastest way to lose the parts that are true is to overstate the parts that are not.

What It Does Not Do

A competent opponent who reads the case law rather than the architecture will not attack the hash chain. They will attack what the chain says nothing about. Four objections are worth naming.

The record is faithful and the decision was wrong. The architecture establishes what the system decided and on what basis. Whether that basis was adequate is the breach question from part two, and it is open.

This is the narrowest gap, and it narrows further than expected. The gate guarantees that action conforms to policy as written. Whether the policy says what its author meant is a different question. Human-authored policy inherits every defect of human-authored instruction. A rule that says do not take unreasonable risk points at a judgment the gate does not have.

That gap can be addressed. A policy predicate can be given a reference set of canonical cases, and the author can see what the rule does across them before it reaches production. Deterministic evaluation makes this possible: the same predicate against the same cases produces the same answers, so the exercise means something. A definition with no test set is not a governed definition. It is a hope with a version number.

Drift is caught by the same mechanism. Replay the current predicate against the frozen reference set on a schedule and after every change. A criterion that has narrowed since it was written shows up as a change in what it catches. That failure is ordinarily invisible, because the policy text never changed.

What remains is the case nobody thought to put in the reference set. That residual is real, and no architecture eliminates it. It is a long way from "the policy layer cannot be governed."

Show that nothing was suppressed before it was written. An append-only log normally cannot answer this. Chaining attests to contents, not to the completeness of inputs. The answer here is structural rather than evidentiary.

Execution is conditioned on the write. The record commits, the commit is confirmed, and only then does the action proceed. An action that cannot record cannot execute. There is no category of unlogged governed action to interrogate.

State that as a mechanism, not a practice. "We log every action" is a promise, and a witness asserting a promise is impeachable: every question about configuration, exceptions, and who could turn it off is in scope. "Execution is conditioned on the write" is an architectural fact that can be examined and demonstrated. The difference is whether logging and authorization are two events or one. Here they are one.

This is also why a mechanism for selective suppression would be catastrophic rather than unwise, and why none exists.

Who verified that the acting system has no write access? This is the real seam. Isolation of the write path is an architectural assertion, and the anchor does not evidence it. Anchoring proves the chain was not edited after the fact. It does not prove the chain was correctly fed. Those are different claims with different proofs. Only the first is cryptographic.

The record and its anchoring are strong on integrity, structural on completeness, and bounded by the anchoring interval.

The same seam runs out to the environment, where it is widest, and where it belongs to the customer. Whether every agent-reachable path to inference and tool endpoints passes through the control is a property of the deployment. The requirement should be stated as a property, not a prescription: no agent-reachable path to inference or tool endpoints bypasses the control, and that set of paths is enumerable and demonstrable. How a network achieves it touches connectivity, market data, and disaster recovery. A vendor prescribing into that has not thought about the environment. Stated as a property, it becomes a test the customer's own network team runs, which is stronger than any vendor assertion.

These records were prepared for litigation. This is the oldest objection in the business-records case law, and a system designed to produce evidence appears to walk into it.

Palmer v. Hoffman is the ancestor of that objection.⁸ It is worth reading for what it tested: not whether a dispute was known, but business purpose. The accident report there was "calculated for use essentially in the court, not in the business," because its "primary utility is in litigating, not in railroading."

The same opinion supplies the contrast class:

It is not, however, typical of entries made systematically or as a matter of routine to record events or occurrences, to reflect transactions with others, or to provide internal controls.

An authorization record is an internal control in the sense the Court meant. Palmer excluded a narrative account of an event, written afterward by a participant. An authorization record is the operating record of the control that permitted the action: the artifact the control produces by functioning, not a report about what the business did.

The framework has also moved. Palmer was decided under the 1936 federal business-records statute. The Advisory Committee that drafted Rule 803(6) declined to carry it forward as a categorical bar: "the direct introduction of motivation is a disturbing factor, since absence of motivation to misrepresent has not traditionally been a requirement of the rule; that records might be self-serving has not been a ground for exclusion." The rule instead "proceeds from the base that records made in the course of a regularly conducted activity will be taken as admissible but subject to authority to exclude" for untrustworthiness.⁹

So the live question is not what Palmer reaches. It is whether 803(6)(E) catches this record, with Palmer as ancestry rather than authority. Self-interest, standing alone, was expressly rejected as a ground.

Many internal controls are adopted partly in anticipation of legal exposure. Segregation of duties, access logging, retention schedules, the whole apparatus of SOX compliance: all may be implemented because of regulatory and legal risk. Prudential motive alone does not disqualify the records they generate under Rule 803(6). If prudential motive tainted the output, no compliance record would be admissible.

Three things forfeit the argument. Logging selectively. Beginning to log after an incident. And shipping any mechanism that lets a customer suppress logging for selected actions. That switch changes the answer to "could this record have been omitted?" from no to yes, for every record the system has ever produced. The completeness of the population is what gives any single entry its weight. A per-action bypass flag is not a feature with an evidentiary caveat. It is a defect in every record downstream of it.

Before the Incident Is Six Weeks Old

Questions to ask about your own deployment:

Authorization. Do actions with consequential effects require approval before they run? Could the system take alternative actions to get the same effects? Are those alternatives guarded and logged in the same way?

Logging. Who writes the record of the authorization? Can they edit the log? Is the log narrative or factual? Is it immutable or tamper-evident? Was the record written retrospectively, prospectively, or concurrent with the effect? Can you replay the authorization decisions that were made, and do they come to the same answer? Who, without an interest in the result, can verify that the log is accurate and complete?

Identity. How do I know where an action is coming from? Is it ultimately using a password as a replacement for an identity?

The one question that matters: am I reconstructing the event, or is this evidence that must show what actually occurred?

The Trade

The record can establish that the institution acted carefully. It can equally establish that it did not. A system built this way will document its own failures in detail. Any system that does not document its own failures raises a question: what else is it not logging?

The goal is narrower than "this prevents harm." It is that when harm arrives, the institution can say what happened, prove it, and be believed. The alternative is discovering, at deposition, that it authorized something it cannot describe.

---

1. Infocomm Media Development Authority of Singapore, Legal Responsibility for AI Agents (Discussion Paper, May 2026), p. 14, discussed in part 3.B.↩︎

2. Fed. R. Evid. 406; see part 3.B.↩︎

3. Fed. R. Evid. 902(11), (13), (14).↩︎

4. Fed. R. Evid. 902(13) advisory committee's note to 2017 amendment.↩︎

5. Fed. R. Evid. 803(6) advisory committee's note to 2014 amendment.↩︎

6. Fed. R. Evid. 902(13), (14) advisory committee's notes to 2017 amendment.↩︎

7. Proposed Fed. R. Evid. 707 (published for public comment Aug. 15, 2025); after public comment, the Advisory Committee continued revising the proposal rather than advancing the published draft for final approval. Advisory Committee on Evidence Rules, agenda materials for October 15, 2026.↩︎

8. Palmer v. Hoffman, 318 U.S. 109, 113–14 (1943).↩︎

9. Fed. R. Evid. 803(6) advisory committee's note to 1972 proposed rules.↩︎